VariantIncompleteCWE-1004

CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag

Description

The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

Abstraction: VariantA weakness tied to a specific language, technology or resource.
Likelihood of exploit: Medium
Status: Incomplete

Common consequences

Confidentiality
Read Application Data
If the HttpOnly flag is not set, then sensitive information stored in the cookie may be exposed to unintended parties.
Integrity
Gain Privileges or Assume Identity
If the cookie in question is an authentication cookie, then not setting the HttpOnly flag may allow an adversary to steal authentication data (e.g., a session ID) and assume the identity of the user.

Potential mitigations

ImplementationEffectiveness: High
Leverage the HttpOnly flag when setting a sensitive cookie in a response.

Related weaknesses

Parent weaknesses

CWE-732Incorrect Permission Assignment for Critical Resource

CAPEC attack patterns that exploit it

CWE 4.20 links no CAPEC attack pattern to this weakness.

Common consequences

Confidentiality

Read Application Data

If the HttpOnly flag is not set, then sensitive information stored in the cookie may be exposed to unintended parties.

Integrity

Gain Privileges or Assume Identity

If the cookie in question is an authentication cookie, then not setting the HttpOnly flag may allow an adversary to steal authentication data (e.g., a session ID) and assume the identity of the user.